What’s Vulnerable › Vulnerabilities

CVE-2019-6852

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-20 · updated 2026-06-17
• Weakness: CWE-200

Description

A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.

Affected products

• Schneider-Electric 140 Cpu6X Firmware: all versions
• Schneider-Electric 140 Noc 77101 Firmware: all versions
• Schneider-Electric 140 Noc 78X00 Firmware: all versions
• Schneider-Electric 140 Noe 771X1 Firmware: all versions
• Schneider-Electric Bmx Noc 0401 Firmware: all versions
• Schneider-Electric Bmx Noe 0100 Firmware: all versions
• Schneider-Electric Bmx Noe 0110 Firmware: all versions
• Schneider-Electric Bmx P34X Firmware: all versions
• Schneider-Electric Tsx Ety X103 Firmware: all versions
• Schneider-Electric Tsx P57X Firmware: all versions

References

• https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/
• https://www.se.com/ww/en/download/document/SEVD-2019-316-02%20/
• https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/

Get alerted when CVE-2019-6852 or the next vulnerability affects your stack